10 matches found
CVE-2024-36498
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...
CVE-2024-36498 Stored cross site scripting
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...
CVE-2024-36498
The Image Access Scan2Net software (versions 7.40 and earlier , 7.42 and earlier , and 7.42B and earlier ) is vulnerable to a stored cross-site scripting (XSS) flaw due to improper input sanitization. An attacker with Poweruser or Admin privileges can use the **
CVE-2023-36498
creationtimestamp| type| source ---|---|--- 2024-02-06 18:26:51+00:00| seen| https://t.me/ctinow/180200 2024-03-01 11:41:34+00:00| seen| https://t.me/ctinow/197526...
CVE-2023-36498
A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to...
CVE-2023-36498
Summary: CVE-2023-36498 affects the Tp-Link ER7206 Omada Gigabit VPN Router (1.3.0 build 20230322 Rel.70591). Talos’ report details a post-authentication command injection vulnerability in the PPTP client exposed via the web interface (PPTP Client page). A specially crafted authenticated HTTP req...
TP-Link ER7206 Omada Gigabit VPN Router uhttpd PPTP client Command injection Vulnerability
Talos Vulnerability Report TALOS-2023-1853 TP-Link ER7206 Omada Gigabit VPN Router uhttpd PPTP client Command injection Vulnerability February 6, 2024 CVE Number CVE-2023-36498 SUMMARY A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206...
CVE-2022-36498
creationtimestamp| type| source ---|---|--- 2022-08-25 18:23:34+00:00| seen| https://t.me/cibsecurity/48730...
CVE-2022-36498
Vulnerability overview: CVE-2022-36498 affects the H3C Magic NX18 Plus device, specifically NX18PV100R003, due to a stack overflow in the function Asp_SetTimingtimeWifiAndLed. The issue is reported as a stack overflow vulnerability in the device firmware; exploitation details indicate a local att...